Captive portal in 2.0 Release not working?
-
simple search on the web gives this….
In the last episode (Dec 29), Imran Imtiaz said:
i am running squid on my freebsd 5.4 now i want to shift on freebsd
6.0 is there a way that I can import my old cached object on the new
system cause i have a huge cache which i don't wanna lose.Just copy your cache directory to the new server and make sure the
new server's squid.conf cache settings match the old one.Maybe sftp into the pfsense the old pfsense. Copy and sftp into new one and replace....
I do not use squid so not sure where it is stored....
-
Sorry, I don't understand the phrase:
@luke240778:those external people who have an antenna to connect,
Perhaps it is hiding a crucial detail.
Sorry, yeah that makes no sense.. what i meant to say is: In the office we connect through WAP, and the captive portal works. If you dont login, the net doesnt work. On the outside i have an antenna serving my WiSP.. Those clients connect to my antenna with their CPE's.. and some of these are passing straight through to the net.. Not getting the captive portal login at all..
-
OK, so some of these persons bypassing the captive portal come through an external AP? Does their access come with a MAC address of the AP (which is one of the bypass MAC addresses) rather than the actual originating MAC address. Or, are these APs routers rather than bridges?
-
As suggested, you need to check the setup of your APs.
Anyway, using a captive portal for authentication usually isn't the best way to go for a WISP, because it is susceptible to MAC addr spoofing. You should consider switching to PPPoE.
-
OK, so some of these persons bypassing the captive portal come through an external AP? Does their access come with a MAC address of the AP (which is one of the bypass MAC addresses) rather than the actual originating MAC address. Or, are these APs routers rather than bridges?
All of the people bypassing the Captive portal are connecting through my Outdoor AP (Ruckus ZoneFlex 2741).. The ZF2741 is basically just a bridge. All of these peoples MAC's show in my DHCP list on pfsense, but for some reason, this all worked perfectly until around 2 weeks ago. Their MAC's show up on the Ruckus as being connected, i see them in DHCP leases but they are not on my MAC pass through list in captive portal, and from Swuid logs i see that they are browsing.
2 Weeks ago 2 things happened.. I updated from 2.0-RC3 to 2.0-RELEASE, and i also updated the Ruckus AP to new firmware.
My office, we connect through a normal indoor AP, in Bridge mode, connected to OPT1 on pfsense, for this, captive portal works as it should..
-
As suggested, you need to check the setup of your APs.
Anyway, using a captive portal for authentication usually isn't the best way to go for a WISP, because it is susceptible to MAC addr spoofing. You should consider switching to PPPoE.
The AP has been working fine as is for months, the setup of these are simple.. my setup basically is as folows:
Pfsense with 3 x NIC.. WAN, LAN and OPT1
LAN IP: 192.168.10.1
OPT1 IP: 192.168.5.1Ruckus ZF2741 outdoor IP settings are just simply (connected to a switch on LAN interface):
IP : 192.168.10.50
GATEWAY: 192.168.10.1Office AP:
192.168.5.254
GATEWAY: 192.168.5.1PPPoE is actually what i have been reading up on and want to do.. but i have around 80 clients and from what i can tell, their antennas (CPE) dont support PPPoE…
-
All of the people bypassing the Captive portal are connecting through my Outdoor AP (Ruckus ZoneFlex 2741).. The ZF2741 is basically just a bridge. All of these peoples MAC's show in my DHCP list on pfsense,
Which DHCP list on pfSense?
Have you verified that the source MAC address in traffic from users unexpectedly bypassing the captive portal is NOT the MAC address of the AP. (I'm not familiar with the ZF 2741 and I have read reports that some APs forward traffic with the MAC address of the AP rather than the MAC address of the client.)
-
All of the people bypassing the Captive portal are connecting through my Outdoor AP (Ruckus ZoneFlex 2741).. The ZF2741 is basically just a bridge. All of these peoples MAC's show in my DHCP list on pfsense,
Which DHCP list on pfSense?
Have you verified that the source MAC address in traffic from users unexpectedly bypassing the captive portal is NOT the MAC address of the AP. (I'm not familiar with the ZF 2741 and I have read reports that some APs forward traffic with the MAC address of the AP rather than the MAC address of the client.)
The DHCP Leases menu.
The SOurce MAC of the users that i am seeing bypassing the CP are the correct MAC of their CPE's, and not the AP. All currently connected clients, which i see in DHCP leases ad browsing are all the correct MAC of their CPE's.
I strangely, today am seeing 1 MAC, in the DHCP leases, also in the squid logs as browsing and downloading, with an IP in the LAN range.. so from the Outdoor AP.. buts its not showing up in the AP as a connected client at all (all other CPE's show up in the " connected clients" list on the AP.
-
I'm experiencing the same probleme with 2.0 release.
Pfsense doesn't add an pass-trough Mac permission to all Mac adresses that authenticate successfully on the captive portal. It seems just to add the pass-trough Mac permission absolutely randomly - sometimes it adds a permission - sometimes not.
The Option "Enable Pass-through MAC automatic additions" is always enabled.
I've tested several snapshots of the 2.0 Version and they definately don't have this problem.
I'm using PFSense NAND 4g on a Alix Board.
-
So there is obviously some bugs still in the 2.0-RELEASE? What can we do to sort this issue? If using the Captive portal to stop unwanted guests on our networks then this is really bad
-
So there is obviously some bugs still in the 2.0-RELEASE? What can we do to sort this issue? If using the Captive portal to stop unwanted guests on our networks then this is really bad
This is definetly a bug. A pretty bad one if you use pfsense in a business enviroment.
-
So there is obviously some bugs still in the 2.0-RELEASE? What can we do to sort this issue? If using the Captive portal to stop unwanted guests on our networks then this is really bad
This is definetly a bug. A pretty bad one if you use pfsense in a business enviroment.
Yeah.. which i do.. it is my captive portal for my WiSP.. Is there anyone out there who may know how to fix this?
It is strange, cause i havent changed my AP.. as in how it works, just did a firmware upgrade. Captive portal i have running on my LAN (WiSP users) and my OPT1 (Office).. is working as it should for Office, but not for WiSP.. Helppppp!!
-
You might find it useful to check the output of
ipfw show
ipfw table all list -
Lets hope that this bug will be fixed with the next update to make the captive portal usable again.
-
Captive portal works fine in 2.0 release.
The one issue here that has details sounds like the clients are coming from one AP's MAC rather than the CPE. The DHCP leases showing the correct MAC has no association to what MAC actually comes from the clients (check the ARP table for that).
-
@cmb:
Captive portal works fine in 2.0 release.
The one issue here that has details sounds like the clients are coming from one AP's MAC rather than the CPE. The DHCP leases showing the correct MAC has no association to what MAC actually comes from the clients (check the ARP table for that).
Hey sorry, not really understanding this.. my AP's i don't have in the Captive Portal MAC passthrough list… they are ust basically super bridges.
Am i misunderstanding?
-
Hey sorry, not really understanding this.. my AP's i don't have in the Captive Portal MAC passthrough list… they are ust basically super bridges.
They may be configured as such but that doesn't mean they're acting as such. There have been multiple reports on here of people's bridged wireless gear rewriting the source MAC on all traffic to the MAC of the AP, even though the firewall gets their DHCP requests coming from their real MAC. Checking Diag>ARP will show whether or not that's happening, what's shown there is the source MAC that's actually coming through.
-
hi
i have same probolem, to solve this just dont use the pass through mac, let them go through the captive portal.
there is even more serious problem, if they put the gatway IP in their proxy which i discovered by luck, there is no way to stop them from using your internet for free, even if you change squid port, it can be easly discovred with nmap.
hadi57
-
@cmb:
They may be configured as such but that doesn't mean they're acting as such. There have been multiple reports on here of people's bridged wireless gear rewriting the source MAC on all traffic to the MAC of the AP, even though the firewall gets their DHCP requests coming from their real MAC. Checking Diag>ARP will show whether or not that's happening, what's shown there is the source MAC that's actually coming through.
I'm using a couple of Linksys WRT54GS AP's, running the Talisman firmware with some ebtables for "client isolation".
When switching to another, more recent DD-WRT firmware version with the same ebtables setup, I saw that the MAC addresses of my clients became: the MAC op the AP ??? >:(
Because my AP's CAN communicate freely with the net to time sync etc, dis was NO good.
I threw out the inter-AP-client-isolation from my AP's.Btw: this is not really a pfSense issue.
there is even more serious problem, if they put the gatway IP in their proxy which i discovered by luck, there is no way to stop them from using your internet for free, even if you change squid port, it can be easly discovred with nmap.
Can you detail this a bit more ?
I have a Opt1 (192.168.2.0/24 - with Captive portal, a DHCP server) running for my clients.
My LAN is 192.168.1.0/24.
The Opt1 interface has the firewall rules that do not permit to touch anything but the Net.
You say that I would be able to toy with the IP settings of a client PC (Wifi or wire), so it can pass right though the Captive Portal (ipfw) firewall …
What about explaining how to do it ?
Do I need to install squid on pfSEnse (which I haven't, I don't think I need squid) so clients could take 'advantage' of that ? -
i am using squid in transparent mode, because that box have only 4mb and 45 concurrent users sometimes, so clients who are updating windoze, antivirus etc. will not eat the bandwidth. i am not saying the connection i perfect this way, but clients can still chatt, browse facebook. i tried once configuring my browser to use the gateway in the proxy setting, and i was shocked to access the internet without even passing to the captive portal, also one of my clients had his access point using dhcp, "i dont remember the detail, it is posted here long ago, so my client was able to use the internet for free and his complaint to me was that internet is slow only.
